User-facing documentation for the CI Tunnel with agent's identity

This issue is to document the feature.

We should say that currently all CI jobs on the configuration project can access all agents attached to it but this will change. The future behavior will change to require explicit opt-in i.e. the user would need to configure an agent explicitly to grant access to CI jobs of a project, including of the configuration project.